Saudi Arabia’s financial sector has digitized at a pace few markets can match, driven by Vision 2030, open banking, instant payments, and a fast-growing fintech ecosystem. Every new digital channel, cloud workload, and payment integration widens the attack surface that banks, insurers, and financing companies must defend against well-resourced regional threat actors. The Saudi Central Bank (SAMA) responded by issuing a single mandatory cybersecurity framework, so that every institution it regulates works to a common and measurable baseline.
This guide explains what the SAMA Cyber Security Framework (SAMA CSF) is, how its four domains are organized, who must comply, and what regulated organizations need to evidence during a SAMA review.
What Is The SAMA Cyber Security Framework (SAMA CSF)?
The SAMA Cyber Security Framework is a mandatory, principle-based framework issued by the Saudi Central Bank to help regulated financial institutions identify and address cyber risk in a consistent way. SAMA published Version 1.0 in May 2017, and the framework superseded the separate cybersecurity circulars the regulator had issued in earlier years.
Being principle-based, it defines a principle, an objective, and control considerations for each subdomain without prescribing specific products or configurations. The framework aligns closely with international standards such as the NIST Cybersecurity Framework and ISO/IEC 27001, which helps institutions map controls they already operate. Teams familiar with NIST security standards will recognize much of its structure and terminology.
What Are The Four Domains Of The SAMA Cyber Security Framework?
The SAMA CSF is organized into four main domains: Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security. Each domain contains subdomains, and each subdomain sets out the principle, objective, and control considerations SAMA expects institutions to meet.
The fourth domain, for example, breaks down into contract and vendor management, outsourcing, and cloud computing, as listed in SAMA’s official rulebook.
| Domain | Focus | Representative subdomains |
| 3.1 Leadership and Governance. | Board accountability and direction. | Governance, Strategy, Policy, Roles and Responsibilities, Awareness, Training. |
| 3.2 Risk Management and Compliance. | Identifying risk and proving conformance. | Risk Management, Regulatory Compliance, Industry Standards, Review, Audits. |
| 3.3 Operations and Technology. | Day-to-day technical protection. | Identity and Access Management, Application Security, Infrastructure Security, Incident, Threat, and Vulnerability Management. |
| 3.4 Third Party Cyber Security. | Risk from vendors and service providers. | Contract and Vendor Management, Outsourcing, Cloud Computing. |
Who Must Comply With The SAMA Cyber Security Framework?
The SAMA CSF applies to every Member Organization regulated by SAMA, which covers banks operating in Saudi Arabia, insurance and reinsurance companies, financing companies, credit bureaus, and financial market infrastructure. All four domains apply in full to banks, while SAMA grants a small number of scoped exceptions to the other institution types.
Non-bank institutions are excluded from the subdomain on compliance with international industry standards, yet PCI DSS and SWIFT Customer Security Controls still apply wherever they handle cardholder data or SWIFT services, an area our PCI DSS compliance services support.
Entities entering the market through SAMA’s Regulatory Sandbox or a new license first meet the Cyber Resilience Fundamental Requirements (CRFR), issued in January 2022, and move to the full set of SAMA requirements once licensed.
What Are The SAMA CSF Maturity Levels, And Which Level Is Required?
The SAMA CSF measures each control against a six-level maturity model, and every Member Organization must operate at Maturity Level 3 or higher. The six levels are:
- Level 0, Non-existent.
- Level 1, Ad-hoc.
- Level 2, Repeatable but informal.
- Level 3, Structured and formalized.
- Level 4, Managed and measurable.
- Level 5, Adaptive.
Level 3 means controls are documented, approved, implemented consistently, and supported by evidence, which is a higher bar than simply having a security tool in place. SAMA’s framework structure guidance also states that reaching Levels 3 to 5 requires meeting every criterion of the lower levels first.
Institutions that depend on informal practices or individual expertise usually sit at Level 2, even when their technical tooling is strong.
How Does SAMA Assess Compliance With The Cyber Security Framework?
SAMA assesses compliance through periodic self-assessments that Member Organizations complete on a SAMA questionnaire, followed by SAMA’s own review and audit of the results. Each control rating must be backed by evidence such as approved policies, board minutes, system logs, test results, and remediation records.
Where a control cannot be implemented, the organization documents compensating controls, an internal risk acceptance, and a formal waiver request to SAMA. In the SAMA readiness engagements our consultants support, the most common weakness is an incomplete evidence trail for controls that are otherwise operating.
Building a year-round audit readiness program turns the self-assessment into a confirmation exercise instead of a last-minute scramble.
How Does The SAMA CSF Govern Third-Party And Cloud Risk?
The SAMA CSF governs third-party risk through its fourth domain, which requires institutions to manage cyber risk across vendor contracts, outsourcing arrangements, and cloud services. Vendor contracts are expected to carry cybersecurity requirements, a right to audit, and incident notification obligations, and vendors should be assessed before onboarding and reviewed periodically afterward.
Material outsourcing and cloud adoption require prior SAMA approval, and the framework sets expectations for where institutional data is stored and how it is protected. Technology and cloud providers serving Saudi banks therefore inherit CSF obligations through their contracts. A modern third-party risk management program with risk scoring helps institutions keep this evidence current across large vendor portfolios.
How Does The SAMA CSF Relate To NCA ECC And PCI DSS?
The SAMA CSF is the sector-specific framework for SAMA-regulated institutions, while the National Cybersecurity Authority’s Essential Cybersecurity Controls (NCA ECC) set the national baseline for government entities and critical national infrastructure operators. Large banks that operate critical infrastructure therefore often map controls to both frameworks and maintain one control library to avoid duplicate evidence. PCI DSS applies alongside the CSF wherever an institution handles cardholder data, and the CSF names it explicitly within its industry standards subdomain. Mapping these frameworks once, with each control tagged to every obligation it satisfies, reduces audit fatigue and gives the board a single view of cyber posture.
How Does SAMA Assess Compliance, Govern Third-Party Risk, And Align With NCA ECC And PCI DSS?
SAMA assesses compliance through periodic self-assessments that Member Organizations complete on a SAMA questionnaire, followed by SAMA’s own review and audit, and each control rating must be backed by evidence such as approved policies, board minutes, system logs, test results, and remediation records. Where a control cannot be implemented, the organization documents compensating controls, an internal risk acceptance, and a formal waiver request to SAMA.
The framework’s fourth domain extends this scrutiny to third parties by requiring vendor contracts with cybersecurity clauses, a right to audit, and incident notification obligations, along with prior SAMA approval for material outsourcing and cloud adoption, so technology and cloud providers serving Saudi banks inherit CSF obligations through their contracts.
The SAMA CSF also operates alongside the National Cybersecurity Authority’s Essential Cybersecurity Controls (NCA ECC), which set the national baseline for government entities and critical infrastructure operators, and alongside PCI DSS, which the CSF names explicitly for institutions handling cardholder data. Large banks that operate critical infrastructure therefore map controls to all three and maintain one control library to avoid duplicate evidence. In the SAMA readiness engagements our consultants support, the most common weakness is an incomplete evidence trail for controls that are otherwise operating, which is why a year-round audit readiness program combined with a modern third-party risk management program with risk scoring turns the self-assessment into a confirmation exercise instead of a last-minute scramble.
How Can Financial Institutions Prepare For A SAMA CSF Assessment?
Financial institutions prepare for a SAMA CSF assessment by running a gap analysis across all four domains, remediating controls below Maturity Level 3, and organizing evidence well before SAMA’s review. A practical sequence starts with confirming applicability and exceptions, then scoring each control against the maturity model, then prioritizing remediation by risk and regulatory exposure. Governance items such as a board-approved cybersecurity strategy, a cybersecurity function independent of IT, and a structured awareness program are frequent early wins because they lift several subdomains at once. Ampcus Cyber’s SAMA CSF compliance services cover gap analysis, policy development, technical control implementation, and continuous maturity improvement.
| Reach SAMA CSF Maturity Level 3 with confidence by talking to Ampcus Cyber’s Saudi compliance specialists about a tailored gap assessment. |
People Also Ask
Is the SAMA Cyber Security Framework mandatory?
Yes, the framework is mandatory for all SAMA-regulated Member Organizations, and SAMA reviews and audits their compliance.
What maturity level does SAMA require?
Every Member Organization must operate at Maturity Level 3, Structured and formalized, or higher across the framework’s controls.
Does ISO 27001 certification satisfy the SAMA CSF?
ISO 27001 certification does not automatically satisfy the SAMA CSF, since SAMA expects evidence against its own control considerations at Maturity Level 3, although many ISO controls map across.
What evidence does SAMA require to demonstrate compliance?
SAMA expects documented evidence that each control exists and operates, such as approved policies, board minutes, risk assessments, system logs, test results, and remediation records.
Does the SAMA CSF apply to IT and cloud service providers?
Providers are covered indirectly, because regulated institutions must pass CSF requirements to them through contracts and audit rights, and material outsourcing needs prior SAMA approval.
What is the difference between SAMA CSF and NCA ECC?
The SAMA CSF is a sector framework for financial institutions, while NCA ECC sets the national baseline for government entities and critical infrastructure.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
